Expand recent MIA literature and improve repository navigation

papers/2024-2026.md

@@ -0,0 +1,99 @@
+# Model Inversion Papers, 2024–2026
+
+This index highlights recent work that cuts across the image/text/graph organization in the main README. Publication status was checked on 8 August 2026.
+
+Status labels: **peer-reviewed**, **accepted**, **preprint**, and **withdrawn submission**.
+
+## Surveys, benchmarks, and evaluation
+
+| Paper | Year / venue / status | Focus | Main contribution |
+|---|---|---|---|
+| [Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses](https://arxiv.org/abs/2402.04013) | 2024, arXiv, **preprint** | Survey/toolbox | Cross-domain survey with an open-source MIA toolbox. |
+| [Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Survey](https://doi.org/10.1007/s10462-025-11248-0) | 2025, Artificial Intelligence Review 58:242, **peer-reviewed** | Survey | Reviews attacks, defenses, applications, datasets, metrics, and open problems. |
+| [MIBench: A Comprehensive Benchmark for Model Inversion Attack and Defense](https://arxiv.org/abs/2410.05159) | 2024, arXiv, **preprint** | Benchmark/toolbox | Implements 16 attacks/defenses and nine evaluation protocols; the ICLR submission was withdrawn. |
+| [Revisiting Model Inversion Evaluation: From Misleading Standards to Reliable Privacy Assessment](https://openaccess.thecvf.com/content/CVPR2026F/html/Ho_Revisiting_Model_Inversion_Evaluation_From_Misleading_Standards_to_Reliable_Privacy_CVPRF_2026_paper.html) | 2026, CVPR Findings, **peer-reviewed** | Evaluation | Identifies false positives caused by evaluation classifiers and proposes MLLM-based assessment. |
+| [An Automated, Scalable Machine Learning Model Inversion Assessment Pipeline](https://arxiv.org/abs/2509.04214) | 2025, arXiv, **preprint** | Practical assessment | Automates visual leakage assessment with four risk dimensions. |
+
+## Image, 3D, and diffusion-prior attacks
+
+| Paper | Year / venue / status | Access / prior | Main contribution |
+|---|---|---|---|
+| [A Closer Look at GAN Priors: Exploiting Intermediate Features for Enhanced Model Inversion Attacks](https://www.ecva.net/papers/eccv_2024/papers_ECCV/html/4642_ECCV_2024_paper.php) | 2024, ECCV, **peer-reviewed** | White-box; GAN intermediate features | IF-GMI searches intermediate generator features under an L1-ball constraint. |
+| [Prediction Exposes Your Face: Black-box Model Inversion via Prediction Alignment](https://www.ecva.net/papers/eccv_2024/papers_ECCV/html/5316_ECCV_2024_paper.php) | 2024, ECCV, **peer-reviewed** | Black-box prediction vectors; StyleGAN | P2I directly aligns prediction vectors with StyleGAN W+ to reduce queries. |
+| [Pseudo-Private Data Guided Model Inversion Attacks](https://openreview.net/forum?id=pyqPUf36D2) | 2024, NeurIPS, **peer-reviewed** | White-box; public and pseudo-private images | Iteratively improves a generative prior with earlier reconstructions. |
+| [Model Inversion Attacks Through Target-Specific Conditional Diffusion Models](https://arxiv.org/abs/2407.11424) | 2024, arXiv, **preprint** | Target-specific conditional diffusion | Diff-MI learns a diffusion prior guided by target predictions. |
+| [Single-Step Diffusion Model-Based Generative Model Inversion Attacks](https://openreview.net/forum?id=TvhEoz1nim) | 2025, ICLR submission, **withdrawn submission** | Distilled diffusion prior; classifier/CLIP | Replaces GAN priors with a single-step diffusion generator and studies CLIP leakage. |
+| [From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning](https://openaccess.thecvf.com/content/CVPR2025/html/Li_From_Head_to_Tail_Efficient_Black-box_Model_Inversion_Attack_via_CVPR_2025_paper.html) | 2025, CVPR, **peer-reviewed** | Confidence scores; surrogate and generator | SMILE combines long-tailed surrogate training with query-efficient derivative-free search. |
+| [MEDUSA: Medical Data Under Shadow Attacks via Hybrid Model Inversion](https://proceedings.mlr.press/v258/azhar25a.html) | 2025, AISTATS, **peer-reviewed** | Gray-box; shadow model | Hybrid optimization and learned reconstruction for medical images. |
+| [ConcreTizer: Model Inversion Attack via Occupancy Classification and Dispersion Control for 3D Point Cloud Restoration](https://openreview.net/forum?id=I4iZmsV4HM) | 2025, ICLR, **peer-reviewed** | 3D feature interface | Reconstructs voxelized point clouds using occupancy and dispersion objectives. |
+| [Diffusion-Driven Universal Model Inversion Attack for Face Recognition](https://arxiv.org/abs/2504.18015) | 2025, arXiv, **preprint** | Face embeddings; fixed diffusion prior | Uses a reusable unconditional diffusion model without target-specific generator training. |
+| [Model Inversion Attack Against Deep Hashing](https://arxiv.org/abs/2511.12233) | 2025, arXiv, **preprint** | Black-box deep hashing; diffusion | Reconstructs retrieval images without private training hash codes. |
+
+## Foundation models and vision-language models
+
+| Paper | Year / venue / status | Exposed interface | Main contribution |
+|---|---|---|---|
+| [Do Vision-Language Models Leak What They Learn? Adaptive Token-Weighted Model Inversion Attacks](https://openaccess.thecvf.com/content/CVPR2026/html/Nguyen_Do_Vision-Language_Models_Leak_What_They_Learn_Adaptive_Token-Weighted_Model_CVPR_2026_paper.html) | 2026, CVPR, **peer-reviewed** | VLM tokens and generated responses | Introduces token/sequence MIAs and SMI-AW for private visual training data. |
+| [Data-Free Model-Related Attacks: Unleashing the Potential of Generative AI](https://www.usenix.org/conference/usenixsecurity25/presentation/ye-attacks) | 2025, USENIX Security, **peer-reviewed** | Black-box target; generative-AI prior | Studies data-free model extraction, membership inference, and model inversion. |
+| [DRAG: Data Reconstruction Attack using Guided Diffusion](https://openreview.net/forum?id=z6GEZ2ogct) | 2025, ICML, **peer-reviewed** | CLIP/DINOv2 intermediate features | Uses guided latent diffusion to reconstruct inputs from deep foundation-model features. |
+
+The single-step diffusion work listed in the preceding section also evaluates privacy leakage in CLIP.
+
+## Collaborative and split inference
+
+| Paper | Year / venue / status | Setting | Main contribution |
+|---|---|---|---|
+| [PATROL: Privacy-Oriented Pruning for Collaborative Inference Against Model Inversion Attacks](https://openaccess.thecvf.com/content/WACV2024/papers/Ding_PATROL_Privacy-Oriented_Pruning_for_Collaborative_Inference_Against_Model_Inversion_Attacks_WACV_2024_paper.pdf) | 2024, WACV, **peer-reviewed** | Collaborative inference defense | Privacy-aware pruning for resource-constrained edge deployment. |
+| [A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning](https://arxiv.org/abs/2405.04115) | 2024, arXiv, **preprint** | Passive split-learning server | FORA transfers representation preferences from public auxiliary data. |
+| [Theoretical Insights in Model Inversion Robustness and Conditional Entropy Maximization for Collaborative Inference Systems](https://openaccess.thecvf.com/content/CVPR2025/html/Xia_Theoretical_Insights_in_Model_Inversion_Robustness_and_Conditional_Entropy_Maximization_CVPR_2025_paper.html) | 2025, CVPR, **peer-reviewed** | Split-inference defense | Relates conditional entropy to reconstruction error and proposes CEM. |
+| [Revisiting the Privacy Risks of Split Inference: A GAN-Based Data Reconstruction Attack via Progressive Feature Optimization](https://arxiv.org/abs/2508.20613) | 2025, arXiv, **preprint** | Split inference; StyleGAN | Progressive feature optimization improves deep-cut and OOD reconstruction. |
+| [Ensembler: Protect Collaborative Inference Privacy from Model Inversion Attack via Selective Ensemble](https://doi.org/10.1109/DAC63849.2025.11132673) | 2025, DAC, **peer-reviewed** | Collaborative-inference defense | Selective ensembles confuse server-side reconstruction with low inference overhead. |
+| [What Your Features Reveal: Data-Efficient Black-Box Feature Inversion Attack for Split DNNs](https://openaccess.thecvf.com/content/CVPR2026/papers/Ren_What_Your_Features_Reveal_Data-Efficient_Black-Box_Feature_Inversion_Attack_for_CVPR_2026_paper.pdf) | 2026, CVPR, **peer-reviewed** | Black-box feature interface | FIA-Flow learns from few image-feature pairs and performs one-step reconstruction. |
+| [Prompt Inversion Attack against Collaborative Inference of Large Language Models](https://arxiv.org/abs/2503.09022) | 2025, arXiv, **preprint** | LLM inter-layer activations | Reconstructs prompts transmitted in collaborative LLM inference. |
+
+## Defenses
+
+| Paper | Year / venue / status | Defense axis | Main contribution |
+|---|---|---|---|
+| [On the Vulnerability of Skip Connections to Model Inversion Attacks](https://www.ecva.net/papers/eccv_2024/papers_ECCV/papers/10529.pdf) | 2024, ECCV, **peer-reviewed** | Architecture | Shows skip connections amplify leakage and proposes MI-resilient designs. |
+| [Improving Robustness to Model Inversion Attacks via Sparse Coding Architectures](https://www.ecva.net/papers/eccv_2024/papers_ECCV/html/10339_ECCV_2024_paper.php) | 2024, ECCV, **peer-reviewed** | Architecture | Uses sparse-coding layers to limit irrelevant private information. |
+| [Trap-MID: Trapdoor-based Defense against Model Inversion Attacks](https://openreview.net/forum?id=GNhrGRCerd) | 2024, NeurIPS, **peer-reviewed** | Misdirection/trapdoor | Makes inversion recover a trapdoor trigger instead of private samples. |
+| [Defending against Model Inversion Attacks via Random Erasing](https://arxiv.org/abs/2409.01062) | 2024, arXiv, **preprint** | Data-centric training | Random erasing reduces recoverable visual detail while retaining task utility. |
+| [Stealthy Shield Defense: A Conditional Mutual Information-Based Approach against Black-Box Model Inversion Attacks](https://openreview.net/forum?id=p0DjhjPXl3) | 2025, ICLR, **peer-reviewed** | Output post-processing | Reduces conditional mutual information without retraining the target model. |
+| [Rank Matters: Understanding and Defending Model Inversion Attacks via Low-Rank Feature Filtering](https://doi.org/10.1145/3770854.3780328) | 2026, KDD, **peer-reviewed** | Low-rank feature filtering | Final version of the work previously titled CALoR; combines confidence adaptation and low-rank filtering. |
+| [Model Inversion Attacks Meet Cryptographic Fuzzy Extractors](https://arxiv.org/abs/2510.25687) | 2025, arXiv, **preprint** | Cryptographic biometric defense | Studies inversion against fuzzy extractors and proposes L2FE-Hash. |
+
+## Text and embedding inversion
+
+| Paper | Year / venue / status | Interface | Main contribution |
+|---|---|---|---|
+| [An Inversion Attack Against Obfuscated Embedding Matrix in Language Model Inference](https://aclanthology.org/2024.emnlp-main.126/) | 2024, EMNLP, **peer-reviewed** | Obfuscated embedding matrix | Recovers text from glide-reflection-obfuscated embeddings. |
+| [ALGEN: Few-shot Inversion Attacks on Textual Embeddings via Cross-Model Alignment and Generation](https://aclanthology.org/2025.acl-long.1185/) | 2025, ACL, **peer-reviewed** | Few-shot black-box embeddings | Cross-model alignment enables inversion with few paired samples. |
+| [ObfusLM: Privacy-preserving Language Model Service against Embedding Inversion Attacks](https://aclanthology.org/2025.acl-long.58/) | 2025, ACL, **peer-reviewed** | Embedding-service defense | Obfuscates embeddings for both classification and generation services. |
+| [PrivacyRestore: Privacy-Preserving Inference in Large Language Models via Privacy Removal and Restoration](https://aclanthology.org/2025.acl-long.532/) | 2025, ACL, **peer-reviewed** | LLM inference defense | Removes private spans client-side and restores task information through privacy-aware vectors. |
+| [Towards Privacy-Preserving Large Language Model: Text-free Inference Through Alignment and Adaptation](https://aclanthology.org/2026.acl-long.1191/) | 2026, ACL, **peer-reviewed** | Noisy pooled embeddings | PPFT protects inference and private-domain fine-tuning without sending raw text. |
+
+## Graph reconstruction
+
+| Paper | Year / venue / status | Interface | Main contribution |
+|---|---|---|---|
+| [ReconXF: Graph Reconstruction Attack via Public Feature Explanations on Privatized Node Features and Labels](https://arxiv.org/abs/2506.02134) | 2025, arXiv, **preprint** | Feature explanations and privatized attributes | Denoises auxiliary node information and reconstructs graph topology. |
+| [GraphToxin: Reconstructing Full Unlearned Graphs from Graph Unlearning](https://arxiv.org/abs/2511.10936) | 2025, arXiv, **preprint** | Graph-unlearning residue | Reconstructs deleted nodes, edges, and neighborhoods; adjacent to classical MIA. |
+
+## Adjacent reconstruction problems
+
+These papers are useful context but should not be presented as classical post-training MIAs without qualification.
+
+| Paper | Year / venue / status | Why adjacent |
+|---|---|---|---|
+| [GRAIN: Exact Graph Reconstruction from Gradients](https://proceedings.iclr.cc/paper_files/paper/2025/hash/b88ccd2117cf61258e868a84145c94ca-Abstract-Conference.html) | 2025, ICLR, **peer-reviewed** | Reconstructs graph structure and features from shared training gradients. |
+| [TINA: Text-Free Inversion Attack for Unlearned Text-to-Image Diffusion Models](https://openaccess.thecvf.com/content/CVPR2026/html/Xiang_TINA_Text-Free_Inversion_Attack_for_Unlearned_Text-to-Image_Diffusion_Models_CVPR_2026_paper.html) | 2026, CVPR, **peer-reviewed** | Attacks concept erasure rather than private classifier training data. |
+| [MIMIC: Multimodal Inversion for Model Interpretation and Conceptualization](https://arxiv.org/abs/2508.07833) | 2025, arXiv, **preprint** | Representation inversion for interpretation rather than a privacy attack. |
+| [Implicit Inversion Turns CLIP into a Decoder](https://openreview.net/forum?id=hvukI2ws5O) | 2025, OpenReview | Representation decoding/generation rather than private-data reconstruction. |
+
+## Maintenance notes
+
+- Merge preprint and final versions into one lineage. In particular, arXiv:2410.05814 (CALoR) became the KDD 2026 paper *Rank Matters*.
+- Do not label MIBench as an ICLR publication; it remains an arXiv preprint and its ICLR submission was withdrawn.
+- Do not label *Single-Step Diffusion Model-Based Generative Model Inversion Attacks* as an accepted ICLR 2025 paper.
+- Distinguish diffusion models used as attack priors from diffusion models that are themselves the attack target.